Cannot Update Virus Protection - Internet Access problem

[cybersteve]

I am running a Windows 2000 Server, SP 2 and using Backup Exec version 8.5. In tightening server security by limiting
via TCP/IP Filtering, the TCP ports and IP Protocols; I have this problem:
If I allow ALL TCP ports then Backup Exec connects and updates the virus protection.
If I limited TCP ports to 25 (email), 53 (dns), 80 (http)
and 110 (IE browser & Norton AV) they work but Backup Exec can not access the update site???
I assume it uses a different port than 110.
I allow all UDP ports and limit IP Protocols to 4 & 6.
Do you know how to resolve this? Thank you...........

 

[jmanning]

Veritas uses FTP to update its virus definition files. You need to enable TCP ports 20 and 21 to allow ftp traffic.

 

[cybersteve]

Thank you for your reply! I added port 20 and 21. Still didn't work. I found an ftp article that says if the ftp site use active ftp, port 21 is the initial control channel connection from the requestors machine. The ftp server uses
port 20 to establish a local channel on the requestors machine (port range 1024 through 5000) and sends the update data file. So, if I allow ALL TCP ports it works. If I have ports 20 and 21 it fails. How do I pick which local machine ports to add?? If my server has retrieved email, browser use, norton update; then windows just increments the
next available channel number - 1024, 1033, 1049, 1067 etc.
thanks for any added help!

 

[Sensibilium]

I had a similar problem with the virus protection update as there isn't any form of setup dialog available for it.

My main problem I feel came from my 'All' protocol rule which is restricted to Domain Users only.

In my situation I found the following rule & filters helps:

Protocol Rule
Scope: Array
Action: Allow
Protocol: FTP
Applies to: Any Request
Schedule: Work Hours (custom schedule)

IP Packet Filters
Mode: Allow
Filter Type: Custom filter
Local Computer: Default External IP address
Remote Computer: Any
Protocol: TCP
Direction: Both
Local Port: All ports
Remote Port: 20

Mode: Allow
Filter Type: Custom filter
Local Computer: Default External IP address
Remote Computer: Any
Protocol: TCP
Direction: Both
Local Port: All ports
Remote Port: 21

And that seems to work fine and dandy. However, I'm not entirely sure that this is the most secure method. If anyone has any comments on securing my protocol rule and IP packet filters further then please tell me (I have little faith in my ISA rules & packets).

Cheers
Ahdkaw
Laptop Cauldrons run Thudex GUI

http://www.sensibilium.com/thud

 

[Grenage]

If it were using PASV FTP would that not require ports >1023 open ? - allowing to external >1023 ?

else on active >1023 to external 21.

If you have the ability to log you could always clear it, attempt the update and see what was going on in the log.